Part 1
Underneath it all, four questions
The four questions that structure a medical device threat model for FDA premarket submissions, and what each one has to produce.
Shareable visual explainers on medical device threat modeling, risk assessment, and security architecture. Every graphic ships with a full text version so it is readable, searchable, and accessible - not just a picture.
How a medical device threat model for an FDA submission is structured, built, and reviewed - from the four questions through STRIDE, attack trees, and the QA gate.
See the underlying serviceThe four questions that structure a medical device threat model for FDA premarket submissions, and what each one has to produce.
The nine-step workflow that turns the four threat modeling questions into a threat table and a residual risk position.
How one row of a medical device cybersecurity hazard analysis links a threat to a patient harm, a security control, and the test that proves it.
The four CVSS 4.0 metric groups and a worked infusion pump example that scores 8.7 High.
The six STRIDE threat types, the security property each one breaks, and an example on a device, phone app, and cloud system.
FDA cybersecurity guidance, Section 524B, and what goes into an eSTAR submission.
See the underlying service
Every FDA cybersecurity guidance and Section 524B milestone from 2014 to 2026, with premarket guidance, postmarket guidance, and the law shown as separate tracks.
The ten core documents the FDA's premarket guidance describes for a cyber device, and what each one has to show in an eSTAR submission.
The four Section 524B requirements for a cyber device submission on one card, each matched to the document that proves it.
What each FDA letter means, when it arrives, how long you have to respond, and what to do next.
What the FDA expects before clearance and what continues after, side by side.
Building, identifying, and monitoring the software bill of materials for a medical device.
See the underlying service
The six repeating steps that keep a medical device SBOM useful after submission: build, identify, monitor, triage, fix, and update.
A side-by-side comparison of PURL and CPE component identifiers for medical device SBOMs: format, who defines names, best use, and weak spots.
How the safety, software, and security standards for medical devices fit together.
See the underlying service
ISO 14971, IEC 62304, IEC 81001-5-1, AAMI SW96, TIR57, TIR97, and IEC 62443 mapped across the product lifecycle.
How our services run, what they include, and what they cost.
See the underlying service
The eight steps of a Blue Goat medical device penetration test, from kickoff to unlimited retests.
Every deliverable in the full-service FDA premarket cybersecurity package, grouped the way the FDA reviews them.
A one-time fixed-fee project, a project followed by a retainer, or an ongoing retainer starting at $5,000 a month.
What an investor diligence review delivers: a one-page summary in about 2 weeks, from $7,500, under NDA.
30-minute strategy session. No cost, no commitment - just answers from people who've supported 275+ FDA submissions, with zero cybersecurity rejections.